Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21870-1 advisory.

    Changes in openai-codex:

    Update to version 0.154.0:

      * Experimental worktree support for isolated checkouts of new         or forked sessions, with browse and resume
      * Answer questions inline while Codex keeps working, keeping         the main draft
      * Vim R replace mode with undo and dot-repeat; /copy keeps         formatting and covers status and session fields
      * Plugin tools refresh after external upgrades, MCP OAuth         refresh is coordinated, helpers no longer run before trust         is established; resume and fork keep saved permissions
      * Drop the deprecated codex mcp-server entry point, now codex mcp
    - Regenerate vendor.tar.zst: rmcp 3.1.3 -> 3.2.0 plus routine       bumps; webrtc/gstreamer/cpal stay out of the codex-cli link       graph, so the License tag is unchanged
    - Legal-Review-Notice: linked-crate count 876/878 -> 880/882 on       aarch64/x86_64; the vendored dependency licence set is unchanged
    - cargo-audit reports the same five advisories as 0.151.0, none       new and none fixable by re-vendoring

    Update to version 0.153.4:

      * GPT-6-Astra is listed in the bundled model picker and is the         bundled default when no model is configured
      * Astra's async-question guidance now applies only when         request_user_input_async is available in the session

    Update to version 0.153.3:

      * GPT-6-Astra is available in the Amazon Bedrock model picker         for Mantle and Runtime global/US routes
      * Astra's async-question guidance now names         request_user_input_async and notes that it accepts text only

    - Keep vendor.tar.zst: 0.153.4 has the same Cargo.lock as 0.153.2,       so the linked crate set, the License tag and the       Legal-Review-Notice counts are unchanged

    - Update to version 0.153.2:

      * Correct the GPT-6-Astra Fast tier description to 2x speed         instead of 1.5x; display text only, request handling is         unchanged

    - Update to version 0.153.1:

      * GPT-6-Astra can be configured through the API without changing         the default model or listing it in the model picker

    - Build against the system bzip2, libzstd, oniguruma and sqlite       instead of the copies bzip2-sys, zstd-sys, onig_sys and       libsqlite3-sys otherwise compile in; drop their bundled()       Provides and add pkgconfig(bzip2), pkgconfig(libzstd),       pkgconfig(oniguruma) >= 6.9.3 and pkgconfig(sqlite3) >= 3.34.1
      * oniguruma and sqlite have no usable manifest switch, so %build         and %check export RUSTONIG_SYSTEM_LIBONIG and         LIBSQLITE3_SYS_USE_PKG_CONFIG instead, and %install now fails         the build unless all four are DT_NEEDED of codex
      * aws-lc stays bundled: aws-lc-sys has no system-library mode

    - Keep vendor.tar.zst: 0.153.2 has the same Cargo.lock as 0.153.0,       so the linked crate set, the License tag and the       Legal-Review-Notice counts are unchanged

    - Update to version 0.153.0:

      * Vim mode gains undo (u) and redo (Ctrl+R), preserving whole         drafts including pasted content and attachments
      * The plugin CLI lists, installs and removes plugins from remote         marketplaces
      * tui.auto_recap = false turns off automatic recaps while keeping         /recap available
      * TUI history shows complete patches, input sent to background         terminals and individual completed commands
      * TUI sessions reconnect after an app-server connection drops,         keeping drafts and holding queued submissions for review
      * Guardian review history survives compaction, restarts and         forks; Full Access skips Guardian review for confirmation-only         actions
      * Remembered MCP tool approvals are scoped to the selected         app account
      * tui.disable_paste_burst replaces the top-level setting, which         stays supported as a fallback
      * New disabled-by-default         features.context_management.experimental_mode

    - Regenerate vendor.tar.zst: the 14 crates 0.153.0 adds to the       lockfile are all Windows-only, so the linked third-party set,       the License tag and the bundled() versions are unchanged; the       Legal-Review-Notice counts move only by one added first-party       workspace member

    - Update to version 0.152.1:

      * Guardian approval review honours Node REPL policies supplied         through model metadata; the bundled policy is now only the         fallback
      * Switching models mid-session is refused when the destination         changes the Guardian parent-fallback node REPL policy

    - Update to version 0.152.0:

      * Vim mode gains / and ? search within drafts, with match         highlighting and n/N repeat navigation
      * Rate-limit banners offer actions for checking usage, managing         credits, resetting limits and managing plans
      * TUI and codex exec show credential-refresh progress,         including Amazon Bedrock reauthentication
      * MCP server names may contain :, @, / and .
      * Individual MCP tools honour an output_token_limit setting
      * App-server clients can configure thread/shellCommand timeouts         longer than one hour
      * Cloud task requests reject untrusted backend URLs and refuse         redirects, protecting saved credentials
      * The planning tool is now disabled by default; re-enable with         tools.update_plan.enabled = true
      * Vim-enabled composers start fresh drafts in Insert mode again

    - cargo-audit reports five advisories on the vendored lockfile, all       pre-existing and unchanged since 0.151.0; audit a bare Cargo.lock       because upstream's codex-rs/.cargo/audit.toml hides four of them:

      * CVE-2026-25800 (RUSTSEC-2026-0185, quinn-proto 0.11.14): not         affected, reqwest gates dep:quinn behind its http3 feature,         which the workspace leaves off, so it is never linked
      * RUSTSEC-2026-0194 and -0195 (quick-xml 0.39.4) and         RUSTSEC-2026-0118 and -0119 (hickory-proto 0.25.2), DoS with no         CVE assigned: linked, but each fix is a semver-incompatible         bump of an intermediate crate, or not released at all

    - Legal-Review-Notice: linked-crate count 874/876 -> 875/877 on       aarch64/x86_64, from one new first-party workspace crate       (codex-guardian-context). The vendored dependency set, the       bundled() versions and the License tag are unchanged from 0.151.0

    - Update to version 0.151.0:

      * Configurable grace period for discovering tools from optional         MCP servers
      * Extensions can inspect or replace MCP tool results before they         reach the model
      * Plugin catalogs combine per-repository configuration and report         invalid project marketplaces without hiding valid plugins
      * Preserve restored permission profiles across TUI turns; /cd can         no longer weaken sandbox restrictions
      * Stale Guardian classifications no longer authorize actions after         a permission-state change
      * Remote sandbox enforcement uses the executor's actual home         directory, OS and path conventions
      * Keep tool availability and reasoning effort correct when         switching models or falling back to another one
      * Nested subagent token usage counts toward root goal budgets

    - Vendored dependency set is unchanged from 0.150.1 (1193 crates,       none added or removed), so the License tally and the bundled()       versions still hold.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in     version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream     fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers     that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to     peers that send fragments while leaving out early parts of the stream, and in particular, fragments with     many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers     from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue. (CVE-2026-25800)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347912	openSUSE 16: openai-codex / openai-codex-bash-completion / etc (openSUSE-SU-2026:21870-1)	Nessus	SuSE Local Security Checks	Local	high
329630	Linux Distros Unpatched Vulnerability : CVE-2026-25800	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-25800

high

Tenable Plugins

high

high